Abstract

This document introduces a new DNSKEY flag called DELEGATION_ONLY
that indicates that the particular zone will never sign zone data
across a label. That is, every label (dot) underneath is considered
a zone cut and must have its own (signed) delegation.